15 matches found
EUVD-2026-101238
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
CVE-2026-110610
The ruoyi-vue-pro framework (versions through 2026.09 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the yudao-module-ai image service. Specifically, the midjourney imagine endpoint fails to properly validate the referImageUrl parameter. This allows authenticated users to fo...
CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the GetByOnlyMJId function in the Midjourney Image Relay Endpoint. An attacker can gain unauthorized access to resources by sending crafted requests to the affected endpoint...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the GetByOnlyMJId function in the Midjourney Image Relay Endpoint. An attacker can gain unauthorized access to resources by sending crafted requests to the affected endpoint...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the GetByOnlyMJId function in the Midjourney Image Relay Endpoint. An attacker can gain unauthorized access to resources by sending crafted requests to the affected endpoint...
CVE-2026-9306
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be...
CVE-2026-9306
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be...
CVE-2026-9306 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be...
EUVD-2026-31542
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be...
CVE-2026-9306
CVE-2026-9306 affects QuantumNous new-api up to 0.12.1, specifically the Midjourney Image Relay Endpoint’s RelayMidjourneyImage/GetByOnlyMJId in router/relay-router.go. The issue enables authorization bypass through manipulation of the endpoint. It is reported as exploitable remotely with high co...
New API 安全漏洞
The New API is an interface software developed by QuantumNous. Versions of the New API prior to 0.12.1 contain security vulnerabilities. These vulnerabilities stem from the RelayMidjourneyImage/GetByOnlyMJId function in the router/relay-router.go file of the Midjourney Image Relay Endpoint...
PT-2026-42886
Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2 Description An issue in the Midjourney Image Relay Endpoint component, specifically within the RelayMidjourneyImage/GetByOnlyMJId function located in the router/relay-router.go file, allows for a...
CVE-2026-9306: Authorization Bypass Through User-Controlled Key
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be...
